##                            ##
#   Snort alert log Monitor    #
#        Author:Plaix          #
##                            ##

import MySQLdb
import commands


class monSnort():
    def __init__(self):
        self.name="Snort db alert log Monitor"
        self.result=""
        self.type="SNORT"
	self.tempt="",""
        #mysql stuff
        self.con = MySQLdb.connect(host ="localhost",user ="root",passwd ="snortlogdb",db ="snort")
        self.cursor=self.con.cursor()
    def check(self):
        self.cursor.execute("SELECT event.timestamp, INET_NTOA(iphdr.ip_src),INET_NTOA(iphdr.ip_dst), signature.sig_name FROM event INNER JOIN iphdr ON event.cid = iphdr.cid AND event.sid = iphdr.sid INNER JOIN signature ON event.signature = signature.sig_id order by event.sid desc limit 1;")
       	output=self.cursor.fetchone()
        if(self.tempt!=output):
                self.tempt=output
		self.result="TSTAMP: "+str(self.tempt[0])+"\nSRC: "+self.tempt[1]+"\nDST: "+self.tempt[2]+"\nATTACK TYPE: "+self.tempt[3]
                return 1
        else:
            return 0
